# Logstash not creating index in kibana

**URL:** <https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780>\
**Category:** Logstash\
**Created:** [August 9, 2021, 9:00am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780 "2021-08-09T09:00:18Z")\
**Posts on this page:** 7\
**Page:** 2

<div class="post-metadata">

**Author:** ![kiran80511](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kiran80511/32/80487_2.png) [@kiran80511](https://discuss.elastic.co/u/kiran80511)\
**Post date:** [August 19, 2021, 6:05am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/21 "2021-08-19T06:05:40Z")

</div>

After putting two space before `path.config` now pipelines.yml error resolve but getting another error

```auto
Aug 19 11:27:20 elastic.sys logstash[2119]: [2021-08-19T11:27:20,599][WARN][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://logstash_writer:xxxxxx@elastic.sys:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'https://elastic.sys:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'https://elastic.sys:9200/'"}

```

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [August 19, 2021, 10:15am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/22 "2021-08-19T10:15:02Z")

</div>

Hi,

It is an error of authentication more [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/401).

Do you have the possibility to run logstash in debug mode to get more informations ?

---

<div class="post-metadata">

**Author:** ![kiran80511](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kiran80511/32/80487_2.png) [@kiran80511](https://discuss.elastic.co/u/kiran80511)\
**Post date:** [August 19, 2021, 10:27am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/23 "2021-08-19T10:27:38Z")

</div>

```auto
[root@elastic logstash]# sudo bin/logstash --config.test_and_exit -f /etc/logstash/conf.d/syslog.conf
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO] 2021-08-19 15:56:16.261 [main] runner - Starting Logstash {"logstash.version"=>"7.13.2", "jruby.version"=>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86_64]"}
[WARN] 2021-08-19 15:56:17.699 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO] 2021-08-19 15:56:19.410 [LogStash::Runner] Reflections - Reflections took 151 ms to scan 1 urls, producing 24 keys and 48 values
[WARN] 2021-08-19 15:56:20.718 [LogStash::Runner] udp - Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode.
[WARN] 2021-08-19 15:56:21.428 [LogStash::Runner] elasticsearch - Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode.
Configuration OK
[INFO] 2021-08-19 15:56:21.714 [LogStash::Runner] runner - Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

```

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [August 19, 2021, 11:15pm UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/24 "2021-08-19T23:15:15Z")

</div>

To run logstash in debug mode :

- add the following line in the logstash.yml file.

```auto
log.level: debug

```

- restart the service

Did you try to run a curl command to make sure of the validity of the password and username ?

---

<div class="post-metadata">

**Author:** ![kiran80511](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kiran80511/32/80487_2.png) [@kiran80511](https://discuss.elastic.co/u/kiran80511)\
**Post date:** [August 20, 2021, 5:43am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/25 "2021-08-20T05:43:35Z")

</div>

After restart the service now getting this error

```auto
Aug 20 11:06:34 elastic.sys logstash[4110]: [2021-08-20T11:06:34,451][ERROR][logstash.outputs.elasticsearch][main] Failed to install template {:message=>"Got response code '403' contacting Elasticsearch at URL 'https://elastic.sys:9200/_template/logstash'", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:306:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:293:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:382:in `with_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:292:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:300:in `block in Pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:379:in `exists?'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:384:in `template_exists?'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:80:in `template_install'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:29:in `install'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch/template_manager.rb:17:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch.rb:496:in `install_template'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch.rb:309:in `finish_register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/outputs/elasticsearch.rb:279:in `block in register'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-11.0.2-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:145:in `block in after_successful_connection'"]}

```

Actually logstash\_writer user doesn't authenticated so I changed the user in configuration file .Now user is logstash\_system . Output of curl command

```auto
[root@elastic conf.d]# curl -XGET https://logstash_system:LiL14stC0M0BZw9iBAY9@elastic.sys:9200
{
  "name" : "elastic",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "jSDbMD2dTO6478GtBOtyyg",
  "version" : {
    "number" : "7.13.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "4d960a0733be83dd2543ca018aa4ddc42e956800",
    "build_date" : "2021-06-10T21:01:55.251515791Z",
    "build_snapshot" : false,
    "lucene_version" : "8.8.2",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
[root@elastic conf.d]#

```

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [August 20, 2021, 7:27am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/26 "2021-08-20T07:27:08Z")

</div>

logstash\_writer seems to don't have the privilege to write index.  
Take a look at the `logstash_writer` [here](https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-http-auth-basic)

Btw, you should create a new topic to make it easier for people who can help you to do it. Moreover, this one have a lot of message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2021, 7:27am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780/27 "2021-09-17T07:27:21Z")

</div>

Closed on September 17, 2021, 7:27am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logstash-not-creating-index-in-kibana/280780.md?page=1)